ResearchPapers, evidence & method
AI-Assisted Cryptanalysis Halves Post-Quantum Candidate HAWK's Security and Sets Two RSA Factoring Records
Before quantum codebreakers exist, AI-assisted classical work is already producing results: Anthropic's Mythos Preview found a key-recovery attack on the NIST candidate HAWK, and GPU-ported number field sieve runs factored RSA-260 and RSA-896. RSA-2048, full AES and ML-KEM remain unbroken.
From the WSJ · Technology article of November 6, 2026 and cited sources: Anthropic says its Claude Mythos Preview model found a key-recovery attack on HAWK in about 60 hours, using roughly $100k of API usage. [2]
SOURCES[2] Anthropic: Discovering cryptographic weaknesses anthropic.com
AT Pulse research deskPublished · Updated · 5 min read · AI-assisted analysisAI-assisted, not human-edited. Methodology Corrections Who owns this site
- What happened
- Anthropic says its Claude Mythos Preview model found a key-recovery attack on HAWK in about 60 hours, using roughly $100k of API usage. [2]
- Original source
- WSJ · Technology article, independent perspective
- Brief by
- AT Pulse research desk AI-assisted; publisher and contact on the desk page
- When
- November 6, 2026 article published
- Covered
- Nov 7 edition
- Evidence
- 9 sources across 9 sites
- 1Quantum Computers Are Poised to Crack Encryption. AI Could…wsj.com
- 2Anthropic: Discovering cryptographic weaknessesanthropic.com
- 3Cognition: Factoring RSA-260cognition.com
- 4Stephen Weis: RSA-896saweis.net
- 5TIME: AI Helped Spark a Quantum Breakthroughtime.com
- 6Security Cryptography Whatever: AI Lattice Proofs With…securitycryptographywhatever.com
Reach: not measured yet
Anthropic says its Claude Mythos Preview model found a key-recovery attack on HAWK in about 60 hours, using roughly $100k of API usage. HAWK is a lattice-based signature scheme NIST is still evaluating. The attack uses the lattice's automorphism structure and halves HAWK's effective security. Anthropic also reports a 7-round AES-128 attack 200–800× faster than earlier work. Both figures come from the company itself. HAWK is not deployed, and full 10-round AES is unaffected. [2]
The two RSA records came from engineering, not new mathematics. Both teams adapted the open-source CADO-NFS to run on GPUs. Cognition factored RSA-260 in about 4,900 GPU-days at an estimated $400k. Stephen Weis, working with Claude, factored RSA-896 on up to 2,048 H100s in about 10 days. Weis says the general number field sieve's underlying runtime did not meaningfully improve. He also says RSA-1024 is now within reach of anyone with a data-centre-scale GPU fleet. [3] [4]
AI is also feeding theory and quantum estimates. Chris Peikert describes an OpenAI model's proof that approximating the closest vector problem within a polynomial factor is NP-hard as genuinely novel. AI-assisted papers improved the exponent for the shortest vector problem without immediate cryptographic impact. An LLM-driven search tool contributed to a quantum resource paper from Oratomic that has not been peer-reviewed. That paper suggests encryption-breaking quantum machines could arrive sooner. [6] [5]
For practitioners, the clearest actions are retiring RSA-1024 and planning against the 2029 post-quantum deadlines that Cloudflare and Google have set, which are earlier than NIST's 2030–2035 targets. HAWK's fast failure argues for systems that can swap algorithms without major rework. [4] [5] [2]
AI has already helped find attacks on a post-quantum candidate and cut factoring costs, without breaking deployed standards.
Read the full assessment
Implication: retire RSA-1024, build algorithm agility, and assume candidates can fail quickly when planning toward the earlier 2029 migration deadlines.
Executive brief
The clearest AI-driven cryptography results of 2026 come from improved classical attacks. They do not come from quantum computers. In July, Anthropic reported that its Claude Mythos Preview model found a key-recovery attack on HAWK in about 60 hours. HAWK is a lattice-based signature scheme that NIST is still evaluating, and the attack halves its effective security (Anthropic). In September, AI-assisted teams that ported a 1990s factoring algorithm to GPUs set two RSA factoring records (Cognition; Weis). The WSJ piece argues that AI-driven maths could weaken encryption before quantum codebreakers arrive (WSJ). No deployed standard such as RSA-2048, AES or ML-KEM has been broken.
What changed and event timeline
AI helps shrink the quantum threat timeline
Google and Oratomic papers suggest encryption-breaking quantum machines could arrive sooner. Oratomic's author credits the LLM-driven OpenEvolve tool for the result. The paper has not been peer-reviewed ().
Mythos attacks HAWK and reduced-round AES
Anthropic reports a lattice-automorphism key-recovery attack on HAWK costing about $100k in API usage. It also reports a 7-round AES-128 attack 200–800× faster than prior work ().
An AI-produced proof advances lattice theory
Chris Peikert discusses an OpenAI model's proof that approximating the closest vector problem (CVP) to within a polynomial factor is NP-hard. He calls the technique genuinely novel ().
RSA-260 factored on GPUs
Cognition completed a GPU-ported version of the general number field sieve (GNFS) in about 4,900 GPU-days, at an estimated cost of $400k ().
RSA-896 factored
Stephen Weis, working with Claude, used up to 2,048 H100 GPUs for about 10 days ().
WSJ frames AI as the earlier threat
The article argues that AI's maths breakthroughs could bring forward the "reckoning" that post-quantum migration is meant to prevent ().
Capabilities and access
- Claude Mythos Preview (Anthropic): HAWK and AES results, plus reduced-round attacks on LEA and Serpent, and minor gains against Salsa20, Poseidon and SHA-1 (Anthropic).
- Factoring: both teams modified the open-source CADO-NFS. Cognition used B200, GB200 and GB300 GPUs (Cognition). Weis used preemptible nodes with 8 H100s each (Weis).
- OpenEvolve: an open-source search tool that uses Gemini and Claude (TIME).
Read the full section
- Claude Mythos Preview (Anthropic): HAWK and AES results, plus reduced-round attacks on LEA and Serpent, and minor gains against Salsa20, Poseidon and SHA-1 (Anthropic).
- Factoring: both teams modified the open-source CADO-NFS. Cognition used B200, GB200 and GB300 GPUs (Cognition). Weis used preemptible nodes with 8 H100s each (Weis).
- OpenEvolve: an open-source search tool that uses Gemini and Claude (TIME).
Technical analysis for researchers and developers
- HAWK: the attack exploits structure in the lattice (automorphisms) rather than generic lattice reduction.
- AES: the attack is a meet-in-the-middle method using a new "Möbius Bridge" fingerprinting step.
- Factoring: the gains are engineering, not new mathematics. Weis says the work did not meaningfully improve GNFS runtime (Weis).
Read the full section
- HAWK: the attack exploits structure in the lattice (automorphisms) rather than generic lattice reduction. A single researcher with a theoretical computer science background mostly guided the project at a management level (Anthropic).
- AES: the attack is a meet-in-the-middle method using a new "Möbius Bridge" fingerprinting step. It took about 1B model tokens and several hundred hours of human validation (Anthropic).
- Factoring: the gains are engineering, not new mathematics. Weis says the work did not meaningfully improve GNFS runtime (Weis). Cognition claims GPU lattice sieving 10× cheaper than the previous public best, and checked its results with CADO-NFS's built-in verification (Cognition).
- Theory: AI-assisted papers improved the exponent for the shortest vector problem (SVP) from 2^n to roughly 2^0.7n. This has no immediate cryptographic impact (SCW).
Claims and evidence
- HAWK security halved; ~60 hours; ~$100k. Reported by Anthropic, which says it disclosed the attack to the HAWK authors and coordinated with NIST (Anthropic).
- RSA-1024 at about $30M. This is Cognition's own estimate (Cognition).
- The Hacker News credits both records to Cognition's agents. Weis's post describes RSA-896 as his work with Claude at Anthropic (THN; Weis).
Read the full section
- HAWK security halved; ~60 hours; ~$100k. Reported by Anthropic, which says it disclosed the attack to the HAWK authors and coordinated with NIST (Anthropic). The claim that HAWK was then withdrawn comes only from secondary reporting (The Hacker News).
- RSA-1024 at about $30M. This is Cognition's own estimate (Cognition).
- Attribution conflict. The Hacker News credits both records to Cognition's agents. Weis's post describes RSA-896 as his work with Claude at Anthropic (THN; Weis).
- Undisclosed lab work. Scott Aaronson reported, secondhand, that AI labs are quietly pointing internal models at cryptographic primitives. This remains unverified (THN).
Context and prior work
- Standards and deadlines: NIST finalised its first post-quantum standards in 2024, with migration targets in 2030–2035.
- Quantum resource estimates: Google's March white paper cut the estimated resources needed to attack elliptic-curve cryptography (CybrSec Media).
- Previous factoring record: RSA-250, factored in February 2020 (Cognition).
Read the full section
- Standards and deadlines: NIST finalised its first post-quantum standards in 2024, with migration targets in 2030–2035. Cloudflare and Google moved their own deadlines up to 2029 (TIME).
- Quantum resource estimates: Google's March white paper cut the estimated resources needed to attack elliptic-curve cryptography (CybrSec Media).
- Previous factoring record: RSA-250, factored in February 2020 (Cognition).
- Non-AI result: AWS's Daniel Simon posted a preprint claiming a polynomial-time quantum algorithm for the dihedral coset problem (DCP), which could matter for lattice cryptography (Quantum Insider).
Limitations, safety and contested findings
- No production risk yet. HAWK is not deployed, and the AES attack does not break the full 10-round cipher (Anthropic). RSA-2048 is unaffected (Weis).
- DCP claim disputed. Peikert says reviewers have found substantial errors in the DCP paper that "don't seem to be easily fixable" (SCW).
- Justin Drake's warning that ECDSA could fall "in months not years" is speculative. Whether such shortcuts exist at all is disputed (CybrSec Media).
Read the full section
- No production risk yet. HAWK is not deployed, and the AES attack does not break the full 10-round cipher (Anthropic). RSA-2048 is unaffected (Weis).
- DCP claim disputed. Peikert says reviewers have found substantial errors in the DCP paper that "don't seem to be easily fixable" (SCW).
- Worst-case warnings. Justin Drake's warning that ECDSA could fall "in months not years" is speculative. Whether such shortcuts exist at all is disputed (CybrSec Media).
- Quantum papers unreviewed. The Oratomic paper's assumptions have not been tested (TIME).
Business and practitioner implications
- Retire RSA-1024 now. Weis says it is within reach of actors with data-centre-scale GPU fleets (Weis).
- Post-quantum candidates can fail quickly under AI-assisted analysis, as HAWK showed, so systems should be able to swap algorithms without major rework.
- The 2029 vendor targets are the ones to plan against (TIME).
Read the full section
- Retire RSA-1024 now. Weis says it is within reach of actors with data-centre-scale GPU fleets (Weis).
- Build crypto-agility. Post-quantum candidates can fail quickly under AI-assisted analysis, as HAWK showed, so systems should be able to swap algorithms without major rework.
- Plan to the earlier deadline. The 2029 vendor targets are the ones to plan against (TIME).
- Use frontier models for in-house cryptanalysis. Teams designing protocols should budget for model-assisted review; one documented attack cost about $100k (Anthropic).
The source trail.
Sources (9)
Quantum Computers Are Poised to Crack Encryption. AI Could Beat Them to It.
Feed excerpt only.
wsj.com